Question

India’s Personal Data Protection Bill, 2019 (‘Bill’) starts encouragingly, seeking to protect “the privacy of individuals relating to their personal data”. But by the end, it is clear it is not designed to deliver on the promise. For, even as it rightly requires handlers of data to abide by globally-accepted rules — about getting an individual’s consent first — it disappointingly gives wide powers to the Government to dilute any of these provisions for its agencies.

Recently, messaging platform WhatsApp said that some Indian journalists and rights activists were among those spied on using technology made by an Israeli company, which by its own admission only works for government agencies across the world.

Importantly, one of the first to raise a red flag about Bill’s problematic clauses was Justice B.N. Srikrishna, whose committee’s report forms the basis of the Bill. He has used words such as “Orwellian” and “Big Brother” in reaction to the removal of safeguards against actions of Government agencies. In its report last July, the committee noted that the dangers to privacy originate from state and non-state actors. It, therefore, called for exemptions to be “watertight”, “narrow”, and available for use in “limited circumstances”. It had also recommended that the Government bring in a law for the oversight of intelligence-gathering activities, the means by which non-consensual processing of data takes place. A related concern about the Bill is regarding the constitution of the Data Protection Authority of India (‘DPA’), which is to monitor and enforce the provisions of the Act. It will be headed by a chairperson and have not more than six whole-time members, all of whom are to be selected by a panel filled with Government nominees. This completely disregards the fact that Government agencies are also regulated under the Bill; they are major collectors and processors of data themselves. The sweeping powers the Bill gives to the Government render meaningless the gains from the landmark K.S. Puttaswamy vs. Union of India case, which culminated in the recognition that privacy is intrinsic to life and liberty, and therefore a basic right. That idea of privacy is certainly not reflected in the Bill in its current form.

Suppose the Bill provides a test of proportionality in respect of privacy, which is: “the act which infringes privacy must have a legitimate aim and must be the least restrictive way of achieving that aim”. If a journalist is known for her reporting on corruption in Government agencies and the Government chooses to engage a surveillance company to collect messages exchanged by her on WhatsApp, in order to intimidate her, does it meet the test of proportionality?

Options

• Yes; without collecting the journalists’ WhatsApp messages, there is no way for the Government to prevent her from reporting against it.

• No; the Government should have taken measures such as imprisoning the journalist to ensure that she does not continue reporting.

• No; conducting surveillance on a journalist to intimidate her is not a legitimate aim.

• Yes; reporting on issues that show the Government in bad light creates disharmony and the Government used proportionate force to prevent the same.

Answer 1

No; conducting surveillance on a journalist to intimidate her is not a legitimate aim.

Explanation:

The correct answer is - No; conducting surveillance on a journalist to intimidate her is not a legitimate aim. This is because it provides a correct explanation for why the Government’s actions fail the test of proportionality as stated above. The test of proportionality requires that an act that infringes privacy must have a legitimate aim. Conducting surveillance on a journalist in order to intimidate her cannot be a legitimate aim.